Method and apparatus to provide secure mobile file system

• US 20060015731A1
• Filed: 06/30/2004
• Published: 01/19/2006
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Lakshmi Narayanan, Ram Gopal
• Granted Patent: US 7,461,259 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

In an exemplary embodiment of this invention there is disclosed a mobile wireless terminal (50) that includes a transceiver (52) for coupling the mobile wireless terminal to a wireless network operator (60), a controller (54) and a memory (56). The memory may be assumed to store a file system program (56A) executable by the controller, and to be operable to store a file having a file data portion (14) for containing file data and a data structure, such as a file header (10), having fields for containing values. A plurality of the fields contain a value of a public cryptographic key (24) associated with a file creator, a seed value (26), an encrypted seed value (28) obtained by encrypting the seed value with a private cryptographic key of the file creator, and a file integrity value (30) obtained using the encrypted seed value and the file data. By the use of the preferred embodiments a file can be traced-back though a plurality of file handlers to a creator of the file.

Claims

1. A method to process a file, comprising:

in response to a file creator creating the file, obtaining a seed value;

encrypting the seed value using a private cryptographic key associated with the file creator to form an encrypted seed value;

storing as part of the file a public cryptographic key associated with the file creator, the seed value and the encrypted seed value;

computing a file integrity value using the encrypted seed value and file data; and

storing as part of the file the computed file integrity value.

2. A method as in claim 1, where the method is executed within a terminal.

3. A method as in claim 1, where the method is executed within a mobile wireless terminal that operates with a wireless operator, and where the private cryptographic key and the public cryptographic key comprise a key pair assigned by a certificate authority associated with the wireless operator.

4. A method as in claim 1, where the method is executed by a network node.

5. A method as in claim 4, where the network node is coupled to a wireless operator that operates with a mobile wireless terminal.

6. A method as in claim 1, further comprising:

storing as part of the file the public cryptographic key associated with the file creator as a value of a current user public key and as a value of a previous user public key;

encrypting the values of the current user public key and the previous user public key using the private cryptographic key associated with the file creator to form an encrypted result; and

storing as part of the file the encrypted result as an encrypted key validation value.

7. A method as in claim 6, where the file creator is considered as User-1, further comprising, in response to another user (User-2) gaining access to the file:

extracting from the file the stored values of the previous user public key, the current user public key, and file integrity value and encrypted result;

in response to User-2 becomes a current user of the file, copying the value from the current user public key to the value of the previous user public key;

inserting the value of the public cryptographic key associated with User-2 as the value of the current user public key;

encrypting the values of the current user public key and the previous user public key using a private cryptographic key associated with User-2 and file integrity value to form a second encrypted result; and

storing as part of the file the second encrypted result as the encrypted key validation value.

8. A method as in claim 7, further comprising:

decrypting the second encrypted result using the value of the public cryptographic key of User-2 to yield the value of the public cryptographic key of User-1; and

associating User-1 with the file creator.

9. A method as in claim 1, where storing as part of the file stores in fields that form a part of a file header.

10. A method as in claim 7, where storing as part of the file stores in predetermined fields that form a part of the file, further comprising accepting the file as a valid file at User-2 only if the predetermined fields are present in the file.

11. A system to process a file, comprising a file creator to create the file, the file creator comprising a unit to obtain a seed value and encrypt the seed value using a private cryptographic key associated with the file creator to form an encrypted seed value;

the file creator unit further operating to store as part of the file a public cryptographic key associated with the file creator, the seed value and the encrypted seed value, to compute a file integrity value using the encrypted seed value and file data and to store as part of the file the computed file integrity value.

12. A system as in claim 11, where the file creator is associated with a terminal.

13. A system as in claim 11, where the file creator is associated with a mobile wireless terminal that operates with a wireless operator, and where the private cryptographic key and the public cryptographic key comprise a key pair assigned by a certificate authority associated with the wireless operator.

14. A system as in claim 11, where the file creator is associated with a network node.

15. A system as in claim 14, where the network node is coupled to a wireless operator that operates with a mobile wireless terminal.

16. A system as in claim 11, where the unit is further operable to store as part of the file the public cryptographic key associated with the file creator as a value of a current user public key and as a value of a previous user public key;

to encrypt the values of the current user public key and the previous user public key using the private cryptographic key associated with the file creator to form an encrypted result; and

to store as part of the file the encrypted result as an encrypted key validation value.

17. A system as in claim 16, where the file creator is considered as User-1, further comprising, in response to another user (User-2) gaining access to the file, a unit to extract from the file the stored values of the previous user public key, the current user public key and the encrypted result;

and responsive to User-2 becoming a current user of the file, to copy the value from the current user public key to the value of the previous user public key;

to insert the value of the public cryptographic key associated with User-2 as the value of the current user public key;

to encrypt the values of the current user public key and the previous user public key using a private cryptographic key associated with User-2 to form a second encrypted result; and

to store as part of the file the second encrypted result as the encrypted key validation value.

18. A system as in claim 17, further comprising a unit to decrypt the second encrypted result using the value of the public cryptographic key of User-2 to yield the value of the public cryptographic key of User-1;

and to associate User-1 with the file creator.

19. A system as in claim 11, where the unit stores in fields that form a part of a file header.

20. A system as in claim 17, where the unit that stores in predetermined fields that form a part of the file, and where the file is accepted as a valid file at User-2 only if the predetermined fields are present in the file.

21. A file having a representation that is storable in a digital data storage medium, the file comprising a file data portion for storing file data and a data structure comprising fields for storing values, at least one of said fields storing a name of the file, and a plurality of others of said fields storing a value of a public cryptographic key associated with a file creator, a seed value, an encrypted seed value obtained by encrypting the seed value with a private cryptographic key of the file creator, and a file integrity value obtained using the encrypted seed value and the file data.

22. A file as in claim 21, said plurality of others of said fields further storing a current user public key value, a previous user public key value, and an encrypted result value obtained by encrypting the current user public key value and the previous user public key value using the private cryptographic key associated with the current user.

23. A file as in claim 21, said plurality of others of said fields further storing a value of a file state indicating at least whether the file is in an open state, a read state or a write state.

24. A file as in claim 22, where encrypted values are obtained by a secure mobile file system file transfer protocol unit that operates in a user space and outside of a kernel space.

25. A digital data storage medium that stores a file comprised of a file data portion for containing file data and a data structure comprising fields for containing values, a plurality of said fields containing a value of a public cryptographic key associated with a file creator, a seed value, an encrypted seed value obtained by encrypting the seed value with a private cryptographic key of the file creator, and a file integrity value obtained using the encrypted seed value and the file data.

26. A digital data storage medium as in claim 25, said plurality of fields further containing a current user public key value, a previous user public key value, and an encrypted result value obtained by encrypting the current user public key value and the previous user public key value using the private cryptographic key associated with the current user.

27. A digital data storage medium as in claim 25, said plurality of fields further containing a value of a file state indicating at least whether the file is in an open state, a read state or a write state.

28. A digital data storage medium as in claim 25, where said digital data storage medium comprises a part of a terminal coupled to a digital data communications network.

29. A digital data storage medium as in claim 25, where said digital data storage medium comprises a part of a mobile wireless terminal that comprises a transceiver for coupling the terminal to a wireless network operator.

30. A digital data storage medium as in claim 25, where said digital data storage medium is coupled with a mobile wireless terminal that comprises a transceiver for coupling the terminal to a wireless network operator.

31. A mobile wireless terminal that comprises a transceiver for coupling the mobile wireless terminal to a wireless network operator, a controller and a memory, said memory storing a file system program executable by said controller and operable to store a file comprised of a file data portion for containing file data and a data structure comprising fields for containing values, a plurality of said fields containing a value of a public cryptographic key associated with a creator of the file, a seed value, an encrypted seed value obtained by encrypting the seed value with a private cryptographic key of the creator of the file, and a file integrity value obtained using the encrypted seed value and the file data.

32. A mobile wireless terminal as in claim 31, said plurality of fields further containing a current user public key value, a previous user public key value, and an encrypted result value obtained by encrypting the current user public key value and the previous user public key value using the private cryptographic key associated with the current user.

33. A mobile wireless terminal as in claim 31, said plurality of fields further containing a value of a file state determined by said file system program to be one of the file is in an open state, a read state or a write state.

34. A mobile wireless terminal as in claim 31, where the public cryptographic key and the private cryptographic key are stored in said memory, and are received through said transceiver from a certificate authority.

35. A mobile wireless terminal as in claim 31, where said mobile wireless terminal comprises a cellular telephone.